Disclosure · Form 10-K · fiscal 2025
NRG Energy, Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed February 24, 2026· period ended December 31, 2025· NRG· CIK 1013871· Updated · filing on sec.gov ↗
NRG Energy, Inc.'s Form 10-K for fiscal 2025, filed February 24, 2026, names the Chief Information Security Officer as its top security role, with oversight by the Finance and Risk Management ("FARM") Committee.
What NRG Energy's Item 1C says
NRG Energy's Form 10-K for fiscal 2025 places primary oversight of cybersecurity risk with the Finance and Risk Management Committee of the Board. The Chief Information Security Officer is the head of cybersecurity for the company and leads the CIC.
Board and management oversight
The FARM Committee reports on its activities to the Board of Directors after each meeting. Under the FARM Committee charter, the committee's responsibilities include an annual review of the company's cybersecurity program and the effectiveness of its risk management strategies. At least twice per year, the CISO provides updates to the Board of Directors on cybersecurity and any recent developments impacting the company. The CISO informs other members of senior management, including the President and CEO, of all aspects related to cybersecurity risks and incidents.
Who leads security
The CISO holds education and certification in security analysis, design, implementation, and management, with a background in technical vulnerability assessment, threat intelligence, and cybersecurity program development. The CISO has overseen cybersecurity efforts across a range of roles, including responsibility for critical infrastructure protection in the energy and utility sectors.
How the company manages cyber risk
The company manages cybersecurity risk based on criteria established by the NIST Cybersecurity Framework. As part of its strategy, the company uses industry and regulatory standards including NERC-CIP, Payment Card Industry Data Security Standard, and IoT Security Assurance Framework. The CIC provides cyber governance, operations, detection and response, engineering, testing, cyber risk management, compliance, training and awareness, and reporting functions to the company. The company conducts regular penetration testing to identify vulnerabilities. The company has implemented structured incident processes and procedures aligned with the NIST framework. The effectiveness of these protocols is routinely assessed through tabletop exercises involving relevant teams and company leadership.
Third parties and incidents
NRG engages certified external assessors to ensure compliance with these standards. The company engages third-party assessors to gain insights into its cyber risk profile. The company relies on third-party service providers in the normal course of business. The company's approach to providers includes due diligence and assessments of their cybersecurity protocols before engagement, and requirements relating to information handling and incident notification. Incidents which may have a material impact on the company are promptly referred to senior leadership and the Board of Directors for review. As of December 31, 2025, the company is not aware of any cybersecurity risks that have materially affected or are reasonably likely to materially affect its business strategy, results of operations and financial condition.
What the section does not state
The section does not name the person who holds the top security role.
Read from the Form 10-K filed February 24, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Chief Information Security Officer
Reports to
not identified
Board oversight
Finance and Risk Management ("FARM") Committee
“The Board of Directors is primarily responsible for the risk oversight of the Company, and has delegated primary oversight of risks related to cybersecurity to the Finance and Risk Management ("FARM") Committee of the Board.”
CISO or other person named
not identified
Frameworks and standards named
NIST Cybersecurity Framework, PCI DSS, NERC CIP
Where the filing names them
- NIST Cybersecurity Framework: “The Company leverages a comprehensive, multi-tiered cybersecurity strategy to manage cybersecurity risk based on criteria established by the NIST Cybersecurity Framework.”
- PCI DSS: “As part of its cybersecurity strategy, the Company utilizes a range of industry and regulatory standards including, but not limited to, NERC-CIP, Payment Card Industry Data Security Standard, and IoT Security Assurance Framework.”
- NERC CIP: “As part of its cybersecurity strategy, the Company utilizes a range of industry and regulatory standards including, but not limited to, NERC-CIP, Payment Card Industry Data Security Standard, and IoT Security Assurance Framework.”
Outside assessors, consultants or testers
Described
“NRG engages certified external assessors to ensure compliance with these standards.”
Experience of the security leadership, as stated
Stated
“The CISO has decades of professional experience, education, and certification in security analysis, design, implementation, and management, with a particularly strong background in technical vulnerability assessment, threat intelligence, and cybersecurity program development.”
Material incident
The filing states none
“As of December 31, 2025, the Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to have a material effect on NRG's business strategy, results of operations and financial condition .”
The section
1,055 words, Form 10-K filed February 24, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on October 20, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns NRG Energy, Inc. standard industrial classification 4911, Electric services (SEC SIC list). 4 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Hallador Energy CoFY 2025, filed March 12, 2026 | not identified | not identified | Audit Committee |
| Talen Energy CorpFY 2025, filed February 26, 2026 | not identified | not identified | Audit Committee |
| FirstEnergyFY 2025, filed February 18, 2026 | CISO | FirstEnergy's Chief Information Officer | Audit Committee |
| Eversource EnergyFY 2025, filed February 17, 2026 | Chief Information Security Officer | Chief Information Officer | Finance and Risk Management Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of NRG Energy, Inc.'s Form 10-K as filed with the SEC on February 24, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C — Cybersecurity
Risk Management and Strategy
The Company leverages a comprehensive, multi-tiered cybersecurity strategy to manage cybersecurity risk based on criteria established by the NIST Cybersecurity Framework. As part of its cybersecurity strategy, the Company utilizes a range of industry and regulatory standards including, but not limited to, NERC-CIP, Payment Card Industry Data Security Standard, and IoT Security Assurance Framework. Compliance with NERC-CIP standards is mandated for entities involved in power generation, transmission, and distribution by regulatory bodies responsible for protecting critical infrastructure within the United States. NRG engages certified external assessors to ensure compliance with these standards.
The Company's strategy seeks to align underlying processes not only with industry standards but also takes into account best practices among peer organizations. The strategy helps ensure a standardized method across all activities at NRG that is designed to allow for consistent recognition, assessment and potential mitigation of significant cybersecurity risks. To further the strategy, the Company established the NRG Cybersecurity Integration Center ("CIC") which is composed of experienced team members from across cybersecurity disciplines with relevant educational and industry experience. The CIC provides the following functions to the Company: cyber governance, operations, detection and response, engineering, testing, cyber risk management (including third-party risks), compliance, training and awareness, and reporting. The CIC utilizes advanced continuous monitoring systems and investigative techniques for real-time threat detection . The systematic monitoring approach allows for risk classification and prioritization based on potential impacts, and facilitates targeted resource allocation according to risk severity. The Company conducts regular penetration testing to proactively identify vulnerabilities and enhance its defense measures. The Company engages third-party assessors to gain comprehensive insights into its cyber risk profile.
The Company relies on third-party service providers in the normal course of business. The Company has established a comprehensive approach to identify and manage cybersecurity risks associated with providers including, but not limited to, rigorous due diligence and assessments of third-party service providers' cybersecurity protocols before engagement, requirements relating to information handling, incident notification and assessment against the Company's cybersecurity requirements. Furthermore, the Company has implemented additional control measures and procedures in business processes designed to enable continuous risk identification and assessment, and to support monitoring mechanisms to oversee and manage supplier cybersecurity practices .
As of December 31, 2025, the Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to have a material effect on NRG's business strategy, results of operations and financial condition . Despite efforts to maintain processes which mitigate cybersecurity risks, there is no guarantee that such risks may not have a material effect on NRG's business strategy, results of operations, and financial condition in the future. For additional information on cybersecurity risks the Company may face, see Item 1A — Risk Factors – "The operation of the Company's businesses is subject to advanced persistent cyber-based security threats and integrity risk. Attacks on NRG's infrastructure that breach cyber/data security measures could expose the Company to significant liabilities, reputational damage, regulatory action, and disrupt business operations, which could have a material adverse effect".
Governance
Management
The Chief Information Security Officer ("CISO") is the head of cybersecurity for the Company and leads the CIC. The CISO has decades of professional experience, education, and certification in security analysis, design, implementation, and management, with a particularly strong background in technical vulnerability assessment, threat intelligence, and cybersecurity
program development. Throughout their career, the CISO has overseen cybersecurity efforts across a range of roles, including responsibility for critical infrastructure protection in the energy and utility sectors.
At least twice per year, the CISO provides comprehensive updates to the Board of Directors on cybersecurity and any recent developments impacting the Company. These updates include, among other items:
• Incident reports and developments from any cybersecurity events;
• Current cybersecurity landscape and emerging cybersecurity threats, with a particular emphasis on Company and industry-specific threats; and
• Status of ongoing initiatives to strengthen the Company's cybersecurity program.
In addition, the CISO regularly informs other members of senior management, including the President and CEO, of all aspects related to cybersecurity risks and incidents. This is intended to ensure that the highest levels of management remain updated on the cybersecurity risk preparedness and potential risks facing the Company. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to the Board of Directors ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.
In preparation for a potential cybersecurity incident, the Company has implemented structured processes and procedures aligned with the NIST framework. This framework provides a foundation for a systematic and consistent approach to preparing for, identifying, containing, eradicating, and recovering from incidents. The effectiveness of these protocols is routinely assessed through tabletop exercises involving relevant teams and Company leadership. In accordance with the Company's process and procedures, incidents which may have a material impact on the Company are promptly referred to senior leadership and the Board of Directors for review and appropriate determination.
Board of Directors
The Board of Directors is primarily responsible for the risk oversight of the Company, and has delegated primary oversight of risks related to cybersecurity to the Finance and Risk Management ("FARM") Committee of the Board. The FARM Committee regularly reports on its activities to the Board of Directors after each meeting . The FARM Committee, as well as the overall Board of Directors, is composed of members with diverse expertise, including risk management, incident response and technology. The Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats and has worked with the Company's management to establish comprehensive oversight mechanisms to help ensure effective cybersecurity governance.
The FARM Committee and the Board of Directors receive updates on any significant developments in the cybersecurity domain, seeking to ensure that the Board of Director's oversight is proactive and responsive. The Board of Directors remains involved in ensuring that cybersecurity considerations are integrated into the Company's broader strategic objectives. Pursuant to the charter of the FARM Committee, the FARM Committee's responsibilities include an annual review of the Company's cybersecurity program and the effectiveness of its risk management strategies. This review is intended to help identify areas for improvement and ensure the alignment of cybersecurity efforts with the overall risk management framework.
Earlier filings on record
Fiscal 2024 Form 10-K, filed February 26, 2025 sec.gov ↗
Top security role, as the filing names it
Chief Information Security Officer
Reports to, as the filing names it
not identified
Board oversight
Finance and Risk Management ("FARM") Committee
“The Board of Directors is primarily responsible for the risk oversight of the Company, and has delegated oversight of risks related to cybersecurity to the Finance and Risk Management ("FARM") Committee of the Board.”
Person named in the filing
not identified
Experience, as stated
Stated
“The CISO has decades of professional experience, education, and certification in security analysis, design, implementation, and management, with a particularly strong background in technical vulnerability assessment and program development.”
Material incident
The filing states none
“As of December 31, 2024, the Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to have a material affect on NRG's business strategy, results of operations and financial condition .”
Read by claude-sonnet-5-5 on October 20, 2026; every quote verified in the stored text by code.
Item 1C — Cybersecurity
Risk Management and Strategy
The Company leverages a comprehensive, multi-tiered cybersecurity strategy to manage cybersecurity risk based on criteria established by the NIST Cybersecurity Framework. As part of its cybersecurity strategy, the Company utilizes a range of industry and regulatory standards including, but not limited to, NERC-CIP, Payment Card Industry Data Security Standard, and IoT Security Assurance Framework. Compliance with NERC-CIP standards is mandated for entities involved in power generation, transmission, and distribution by regulatory bodies responsible for protecting critical infrastructure within the United States. NRG engages certified external assessors to ensure compliance with these standards.
The Company's strategy seeks to align underlying processes not only with industry standards but also mirror best practices among peer organizations. The strategy ensures a standardized method across all activities at NRG allowing for consistent recognition, assessment and potential mitigation of significant cybersecurity risks. To further the strategy, the Company established the NRG Cybersecurity Integration Center ("CIC") which is composed of experienced team members from across cybersecurity disciplines with relevant educational and industry experience. The CIC provides the following functions to the Company: cyber governance, operations, detection and response, engineering, testing, cyber risk management (including third-party risks), compliance, training and awareness, and reporting. The CIC utilizes advanced continuous monitoring systems and investigative techniques for real-time threat detection . The systematic monitoring approach allows for risk classification and prioritization based on potential impacts, and facilitates targeted resource allocation according to risk severity. The Company conducts regular penetration testing to proactively identify vulnerabilities and enhance its defense measures. The Company engages third-party assessors to gain comprehensive insights into its cyber risk profile.
The Company relies on third-party service providers in the normal course of business. The Company has established a comprehensive approach to identify and manage cybersecurity risks associated with providers including, but not limited to, rigorous due diligence and assessments of third-party service providers' cybersecurity protocols before engagement, requirements relating to information handling, incident notification and assessment against the Company's cybersecurity requirements. Furthermore, the Company has implemented additional control measures and procedures in business processes to enable continuous risk identification and assessment, and to support monitoring mechanisms to oversee and manage supplier cybersecurity practices .
As of December 31, 2024, the Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to have a material affect on NRG's business strategy, results of operations and financial condition . Despite efforts to maintain processes which mitigate cybersecurity risks, there is no guarantee that such risks may not have a material affect on NRG's business strategy, results of operations, and financial condition in the future. For additional information on cybersecurity risks the Company may face, see Item 1A — Risk Factors – "The operation of the Company's businesses is subject to advanced persistent cyber-based security threats and integrity risk. Attacks on NRG's infrastructure that breach cyber/data security measures could expose the Company to significant liabilities, reputational damage, regulatory action, and disrupt business operations, which could have a material adverse effect".
Governance
Management
The Chief Information Security Officer ("CISO") is the head of cybersecurity for the Company and leads the CIC. The CISO has decades of professional experience, education, and certification in security analysis, design, implementation, and management, with a particularly strong background in technical vulnerability assessment and program development. Within various roles throughout the CISO's career, he has overseen information assurance and cybersecurity efforts, including critical infrastructure protection in government agencies and industry.
At least twice per year, the CISO provides comprehensive updates to the Board of Directors on cybersecurity and any recent developments impacting the Company. These updates include, among other items:
• Incident reports and developments from any cybersecurity events;
• Current cybersecurity landscape and emerging cybersecurity threats, with a particular emphasis on Company and industry-specific threats; and
• Status of ongoing initiatives to strengthen the Company's cybersecurity program.
In addition, the CISO regularly informs other members of senior management, including the President and CEO, of all aspects related to cybersecurity risks and incidents. This is intended to ensure that the highest levels of management remain updated on the cybersecurity risk preparedness and potential risks facing the Company. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to the Board of Directors ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.
In preparation for a potential cybersecurity incident, the Company has implemented structured processes and procedures aligned with the NIST framework. This framework provides a foundation for a systematic and consistent approach to preparing for, identifying, containing, eradicating, and recovering from incidents. The effectiveness of these protocols is routinely verified through tabletop exercises involving relevant teams and Company leadership. In accordance with the Company's process and procedures, incidents which may have a material impact on the Company are promptly referred to senior leadership and the Board of Directors for review and appropriate determination.
Board of Directors
The Board of Directors is primarily responsible for the risk oversight of the Company, and has delegated oversight of risks related to cybersecurity to the Finance and Risk Management ("FARM") Committee of the Board. The FARM Committee regularly reports on its activities to the Board of Directors after each meeting . The FARM Committee, as well as the overall Board of Directors, is composed of members with diverse expertise, including risk management, incident response and technology. The Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats and has worked with the Company's management to establish comprehensive oversight mechanisms to ensure effective cybersecurity governance.
The FARM Committee and the Board of Directors receive updates on any significant developments in the cybersecurity domain, seeking to ensure that the Board of Director's oversight is proactive and responsive. The Board of Directors remains involved in ensuring that cybersecurity considerations are integrated into the Company's broader strategic objectives. Pursuant to the charter of the FARM Committee, the FARM Committee's responsibilities include an annual review of the Company's cybersecurity program and the effectiveness of its risk management strategies. This review is intended to help identify areas for improvement and ensure the alignment of cybersecurity efforts with the overall risk management framework.
Fiscal 2023 Form 10-K, filed February 28, 2024 sec.gov ↗
Top security role, as the filing names it
Chief Information Security Officer
Reports to, as the filing names it
not identified
Board oversight
Finance and Risk Management ("FARM") Committee
“The Board of Directors is primarily responsible for the risk oversight of the Company, and has delegated oversight of risks related to cybersecurity to the Finance and Risk Management ("FARM") Committee of the Board.”
Person named in the filing
not identified
Experience, as stated
Stated
“The CISO has decades of professional experience, education, and certification in security analysis, design, implementation, and management, with a particularly strong background in technical vulnerability assessment and program development.”
Material incident
The filing states none
“Through December 31, 2023, no cybersecurity threats have been identified or are anticipated to have a material adverse effect on NRG's business strategy, financial standing, or operational performance.”
Read by claude-sonnet-5-5 on October 20, 2026; every quote verified in the stored text by code.
Item 1C — Cybersecurity
Risk Management and Strategy
The Company leverages a comprehensive, multi-tiered cybersecurity strategy to manage cybersecurity risk based on criteria established by the NIST Cybersecurity Framework. As part of the cybersecurity strategy the Company utilizes a range of industry and regulatory standards including, but not limited to, NERC-CIP, PCI DSS, and IoT Security Assurance Framework. Compliance with NERC-CIP standards is mandated for entities involved in power generation, transmission, and distribution by regulatory bodies to which the purpose of is to protect critical infrastructure within the United States. NRG engages certified external assessors to ensure compliance with standards.
The Company's strategy seeks to align underlying processes not only with industry standards but also mirror best practices among peer organizations. The strategy ensures a standardized method across all activities at NRG allowing for consistent recognition, assessment and potential mitigation of significant cybersecurity risks. To further the strategy, the Company established the NRG Cybersecurity Integration Center ("CIC") which is composed of experienced team members from across cybersecurity disciplines with relevant educational and industry experience. The CIC provides the following functions to the Company: cyber governance, operations, detection and response, engineering, testing, cyber risk management (including third-party), compliance, training and awareness, and reporting. The CIC utilizes advanced continuous monitoring systems and investigative techniques for real-time threat detection. The systematic monitoring approach allows for risk classification and prioritization based on potential impacts, facilitating targeted resource allocation according to risk severity. The Company conducts regular penetration testing to proactively identify vulnerabilities and enhance its defense measures. The Company engages third-party assessors to gain comprehensive insights into its cyber risk profile's composition.
The Company relies on third-party service providers in the normal course of business. The Company has established a comprehensive approach to identify and manage cybersecurity risks associated with providers including, but not limited to, rigorous due diligence and assessments of third-party service providers' cybersecurity protocols before engagement, requirements relating to information handling, incident notification and assessment against the Company's cybersecurity requirements. Furthermore, the Company has implemented additional control measures and procedures in business processes to enable continuous risk identification, assessment and to support monitoring mechanisms to oversee and manage supplier cybersecurity practices.
Through December 31, 2023, no cybersecurity threats have been identified or are anticipated to have a material adverse effect on NRG's business strategy, financial standing, or operational performance.
Governance
Management
The Chief Information Security Officer ("CISO") is the head of cybersecurity for the Company and leads the NRG Cybersecurity Integration Center. The CISO has decades of professional experience, education, and certification in security analysis, design, implementation, and management, with a particularly strong background in technical vulnerability assessment and program development. Within various roles throughout the CISO's career, he has overseen information assurance and cybersecurity efforts, including critical infrastructure protection in government agencies and industry.
At least twice per year, the CISO provides comprehensive updates to the Board on cybersecurity and any recent developments impacting the Company. These updates include, among other items:
• Incident reports and developments from any cybersecurity events;
• Current cybersecurity landscape and emerging cybersecurity threats, with a particular emphasis on Company and industry-specific threats; and
• Status of ongoing initiatives to strengthen the Company's cybersecurity program.
In addition, the CISO regularly informs other members of senior management, including the Interim President and CEO, of all aspects related to cybersecurity risks and incidents. This is intended to ensure that the highest levels of management remain
updated on the cybersecurity preparedness and potential risks facing the Company. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to the Board of Directors ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.
In preparation for a potential cybersecurity incident, the Company has implemented structured processes and procedures aligned with the NIST framework. This framework provides a foundation for a systematic and consistent approach to preparing for, identifying, containing, eradicating, and recovering from incidents. The effectiveness of these protocols is routinely verified through tabletop exercises involving relevant teams and Company leadership. In accordance with the Company's process and procedures, incidents which may have a material impact on the Company are promptly referred to senior leadership and the Board of Directors for review and appropriate determination.
Board of Directors
The Board of Directors is primarily responsible for the risk oversight of the Company, and has delegated oversight of risks related to cybersecurity to the Finance and Risk Management ("FARM") Committee of the Board. The FARM Committee regularly reports on its activities to the Board after each meeting. The FARM Committee, as well as the overall Board, is composed of members with diverse expertise, including risk management, incident response and technology. The Board is aware of the critical nature of managing risks associated with cybersecurity threats and has worked with the Company's management to establish comprehensive oversight mechanisms to ensure effective cybersecurity governance.
The FARM Committee and the Board receive updates on any significant developments in the cybersecurity domain, seeking to ensure that the Board's oversight is proactive and responsive. The Board remains involved in ensuring that cybersecurity considerations are integrated into the Company's broader strategic objectives. Pursuant to the charter of the FARM Committee, the Committee's responsibilities include an annual review of the Company's cybersecurity program and the effectiveness of its risk management strategies. This review is intended to help identify areas for improvement and ensure the alignment of cybersecurity efforts with the overall risk management framework.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.